- Arch-security - lists.archlinux.org

[arch-security] [ASA-201704-7] weechat: denial of service
by Christian Rebischke 24 Apr '17

24 Apr '17

Arch Linux Security Advisory ASA-201704-7 ========================================= Severity: High Date : 2017-04-23 CVE-ID : CVE-2017-8073 Package : weechat Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-253 Summary ======= The package weechat before version 1.7.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.7.1-1. # pacman -Syu "weechat>=1.7.1-1" The problem has been fixed upstream in version 1.7.1. Workaround ========== Use the following workaround for weechat>=1.1: /trigger add irc_dcc_quotes modifier "irc_in_privmsg" "${arguments} \ =~ ^[^ ]+ :${\x01}DCC SEND ${\x22} " "/.*//" Description =========== WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function during quote removal, which results in a buffer overflow. Impact ====== A remote attacker is able to crash the application via a maliciously crafted DCC-request. References ========== https://weechat.org/download/security/ https://github.com/weechat/weechat/commit/2fb346f25f79e412cf0ed314fdf791763… https://security.archlinux.org/CVE-2017-8073

1 0

[arch-security] [ASA-201704-6] firefox: multiple issues
by Remi Gacogne 21 Apr '17

21 Apr '17

Arch Linux Security Advisory ASA-201704-6 ========================================= Severity: Critical Date : 2017-04-21 CVE-ID : CVE-2017-5429 CVE-2017-5430 CVE-2017-5432 CVE-2017-5433 CVE-2017-5434 CVE-2017-5435 CVE-2017-5436 CVE-2017-5437 CVE-2017-5438 CVE-2017-5439 CVE-2017-5440 CVE-2017-5441 CVE-2017-5442 CVE-2017-5443 CVE-2017-5444 CVE-2017-5445 CVE-2017-5446 CVE-2017-5447 CVE-2017-5448 CVE-2017-5449 CVE-2017-5451 CVE-2017-5453 CVE-2017-5454 CVE-2017-5455 CVE-2017-5456 CVE-2017-5458 CVE-2017-5459 CVE-2017-5460 CVE-2017-5461 CVE-2017-5464 CVE-2017-5465 CVE-2017-5466 CVE-2017-5467 CVE-2017-5468 CVE-2017-5469 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-249 Summary ======= The package firefox before version 53.0-1 is vulnerable to multiple issues including arbitrary code execution, cross-site scripting, access restriction bypass, arbitrary filesystem access, denial of service, information disclosure and content spoofing. Resolution ========== Upgrade to 53.0-1. # pacman -Syu "firefox>=53.0-1" The problems have been fixed upstream in version 53.0. Workaround ========== None. Description =========== - CVE-2017-5429 (arbitrary code execution) Mozilla developers and community members Christian Holler, Jon Coppeard, Marcia Knous, David Baron, Mats Palmgren, Ronald Crane, Bob Clary, and Chris Peterson reported memory safety bugs present in Firefox 52, Firefox ESR 45.8, and Firefox ESR 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. - CVE-2017-5430 (arbitrary code execution) Mozilla developers and community members Christian Holler, Jon Coppeard, Milan Sreckovic, Tyson Smith, Ronald Crane, Randell Jesup, Philipp, Tooru Fujisawa, and Kan-Ru Chen reported memory safety bugs present in Firefox 52 and Firefox ESR 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. - CVE-2017-5432 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 53. It occurs during certain text input selection and results in a potentially exploitable crash. - CVE-2017-5433 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 53, It occurs in SMIL animation functions when pointers to animation elements in an array are dropped from the animation controller while still in use. This results in a potentially exploitable crash. - CVE-2017-5434 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 53. It occurs when redirecting focus handling and results in a potentially exploitable crash. - CVE-2017-5435 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 53. It occurs during transaction processing in the editor during design mode interactions and results in a potentially exploitable crash. - CVE-2017-5436 (arbitrary code execution) An out-of-bounds write has been found in the Graphite 2 library, triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products. - CVE-2017-5437 (denial of service) Three vulnerabilities were reported in the Libevent library that allow for out-of-bounds reads and denial of service (DoS) attacks: CVE-2016-10195, CVE-2016-10196, and CVE-2016-10197. These were fixed in the Libevent library and these changes were ported to Mozilla code in Firefox 53. - CVE-2017-5438 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 53, during XSLT processing due to the result handler being held by a freed handler during handling. This results in a potentially exploitable crash. - CVE-2017-5439 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 53, during XSLT processing due to poor handling of template parameters. This results in a potentially exploitable crash. - CVE-2017-5440 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 53, during XSLT processing due to a failure to propagate error conditions during matching while evaluating context, leading to objects being used when they no longer exist. This results in a potentially exploitable crash. - CVE-2017-5441 (arbitrary code execution) A use-after-free vulnerability when holding a selection during scroll events has been found in Firefox < 53. This results in a potentially exploitable crash. - CVE-2017-5442 (arbitrary code execution) A use-after-free vulnerability during changes in style when manipulating DOM elements has been found in Firefox < 53. This results in a potentially exploitable crash. - CVE-2017-5443 (arbitrary code execution) An out-of-bounds write vulnerability has been found in Firefox < 53, while decoding improperly formed BinHex format archives. - CVE-2017-5444 (information disclosure) A buffer overflow vulnerability has been found in Firefox < 53, while parsing application/http-index-format format content when the header contains improperly formatted data. This allows for an out-of-bounds read of data from memory. - CVE-2017-5445 (information disclosure) A vulnerability has been found in Firefox < 53, while parsing application/http-index-format format content where uninitialized values are used to create an array. This could allow the reading of uninitialized memory into the arrays affected. - CVE-2017-5446 (arbitrary code execution) An out-of-bounds read has been found in Firefox < 53, when an HTTP/2 connection to a servers sends DATA frames with incorrect data content. This leads to a potentially exploitable crash. - CVE-2017-5447 (arbitrary code execution) An out-of-bounds read has been found in Firefox < 53, during the processing of glyph widths while rendering text layout. This results in a potentially exploitable crash and could allow an attacker to read otherwise inaccessible memory. - CVE-2017-5448 (arbitrary code execution) A security issue has been found in Firefox < 53, an out-of-bounds write in ClearKeyDecryptor while decrypting some Clearkey-encrypted media content. The ClearKeyDecryptor code runs within the Gecko Media Plugin (GMP) sandbox. If a second mechanism is found to escape the sandbox, this vulnerability allows for the writing of arbitrary data within memory, resulting in a potentially exploitable crash. - CVE-2017-5449 (arbitrary code execution) A possibly exploitable crash has been found in Firefox < 53, triggered during layout and manipulation of bidirectional unicode text in concert with CSS animations. - CVE-2017-5451 (content spoofing) A security issue has been found in Firefox < 53, allowing to spoof the addressbar through the user interaction on the addressbar and the onblur event. The event could be used by script to affect text display to make the loaded site appear to be different from the one actually loaded within the addressbar. - CVE-2017-5453 (content spoofing) A security issue has been found in Firefox < 53, allowing to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL parameters for a feed's TITLE element. This vulnerability allows for spoofing but no scripted content can be run. - CVE-2017-5454 (access restriction bypass) A security issue has been found in Firefox < 53, allowing to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This allows for read only access to the local file system. - CVE-2017-5455 (access restriction bypass) A security issue has been found in Firefox < 53. The internal feed reader APIs that crossed the sandbox barrier allowed for a sandbox escape and escalation of privilege if combined with another vulnerability that resulted in remote code execution inside the sandboxed process. - CVE-2017-5456 (arbitrary filesystem access) A security issue has been found in Firefox < 53, allowing to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This allows for read and write access to the local file system. - CVE-2017-5458 (cross-site scripting) An issue has been found in Firefox < 53. When a javascript: URL is drag and dropped by a user into the addressbar, the URL will be processed and executed. This allows for users to be socially engineered to execute an XSS attack on themselves. - CVE-2017-5459 (arbitrary code execution) A buffer overflow has been found in the WebGL part of Firefox < 53. It's triggerable by web content, resulting in a potentially exploitable crash. - CVE-2017-5460 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 53. It's located in frame selection, triggered by a combination of malicious script content and key presses by a user. This results in a potentially exploitable crash. - CVE-2017-5461 (arbitrary code execution) An out-of-bounds write during Base64 decoding operation has been found in the Network Security Services (NSS) library due to insufficient memory being allocated to the buffer. An attacker could use this flaw to create a specially crafted certificate which, when parsed by NSS, could cause it to crash or execute arbitrary code, using the permissions of the user running an application compiled against the NSS library. The issue has been fixed in releases 3.29.5 and 3.30.1. - CVE-2017-5464 (arbitrary code execution) A security issue has been found in Firefox < 53. During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessibility tree, leading to memory corruption and a potentially exploitable crash. - CVE-2017-5465 (information disclosure) An out-of-bounds read has been found in Firefox < 53, while processing SVG content in ConvolvePixel. This results in a crash and also allows for otherwise inaccessible memory being copied into SVG graphic content, which could then displayed. - CVE-2017-5466 (cross-site scripting) An origin confusion issue has been found in Firefox < 53. If a page is loaded from an original site through a hyperlink and contains a redirect to a data:text/html URL, triggering a reload will run the reloaded data:text/html page with its origin set incorrectly. This allows for a cross-site scripting (XSS) attack. - CVE-2017-5467 (denial of service) A potential memory corruption and crash has been found in Firefox < 53, when using Skia content when drawing content outside of the bounds of a clipping region. - CVE-2017-5468 (denial of service) An issue with incorrect ownership model of privateBrowsing information exposed through developer tools has been found in Firefox < 53. This can result in a non-exploitable crash when manually triggered during debugging. - CVE-2017-5469 (arbitrary code execution) Several potential buffer overflows in generated code, due to the CVE-2016-6354 issue in Flex, have been fixed in Firefox 53. Impact ====== A remote attacker can spoof content, bypass access restrictions, access arbitrary files and sensitive information, crash the application and execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/ https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5429 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1343261%2C1350844%2C1341096… https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5430 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1342101%2C1340482%2C1344686… https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5432 https://bugzilla.mozilla.org/show_bug.cgi?id=1346654 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5433 https://bugzilla.mozilla.org/show_bug.cgi?id=1347168 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5434 https://bugzilla.mozilla.org/show_bug.cgi?id=1349946 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5435 https://bugzilla.mozilla.org/show_bug.cgi?id=1350683 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5436 https://bugzilla.mozilla.org/show_bug.cgi?id=1345461 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5437 https://bugzilla.mozilla.org/show_bug.cgi?id=1343453 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5438 https://bugzilla.mozilla.org/show_bug.cgi?id=1336828 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5439 https://bugzilla.mozilla.org/show_bug.cgi?id=1336830 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5440 https://bugzilla.mozilla.org/show_bug.cgi?id=1336832 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5441 https://bugzilla.mozilla.org/show_bug.cgi?id=1343795 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5442 https://bugzilla.mozilla.org/show_bug.cgi?id=1347979 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5443 https://bugzilla.mozilla.org/show_bug.cgi?id=1342661 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5444 https://bugzilla.mozilla.org/show_bug.cgi?id=1344461 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5445 https://bugzilla.mozilla.org/show_bug.cgi?id=1344467 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5446 https://bugzilla.mozilla.org/show_bug.cgi?id=1343505 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5447 https://bugzilla.mozilla.org/show_bug.cgi?id=1343552 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5448 https://bugzilla.mozilla.org/show_bug.cgi?id=1346648 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5449 https://bugzilla.mozilla.org/show_bug.cgi?id=1340127 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5451 https://bugzilla.mozilla.org/show_bug.cgi?id=1273537 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5453 https://bugzilla.mozilla.org/show_bug.cgi?id=1321247 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5454 https://bugzilla.mozilla.org/show_bug.cgi?id=1349276 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5455 https://bugzilla.mozilla.org/show_bug.cgi?id=1341191 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5456 https://bugzilla.mozilla.org/show_bug.cgi?id=1344415 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5458 https://bugzilla.mozilla.org/show_bug.cgi?id=1229426 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5459 https://bugzilla.mozilla.org/show_bug.cgi?id=1333858 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5460 https://bugzilla.mozilla.org/show_bug.cgi?id=1343642 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5461 https://bugzilla.mozilla.org/show_bug.cgi?id=1344380 https://hg.mozilla.org/projects/nss/rev/ac34db053672 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5464 https://bugzilla.mozilla.org/show_bug.cgi?id=1347075 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5465 https://bugzilla.mozilla.org/show_bug.cgi?id=1347617 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5466 https://bugzilla.mozilla.org/show_bug.cgi?id=1353975 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5467 https://bugzilla.mozilla.org/show_bug.cgi?id=1347262 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5468 https://bugzilla.mozilla.org/show_bug.cgi?id=1329521 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5469 https://bugzilla.mozilla.org/show_bug.cgi?id=1292534 https://security.archlinux.org/CVE-2017-5429 https://security.archlinux.org/CVE-2017-5430 https://security.archlinux.org/CVE-2017-5432 https://security.archlinux.org/CVE-2017-5433 https://security.archlinux.org/CVE-2017-5434 https://security.archlinux.org/CVE-2017-5435 https://security.archlinux.org/CVE-2017-5436 https://security.archlinux.org/CVE-2017-5437 https://security.archlinux.org/CVE-2017-5438 https://security.archlinux.org/CVE-2017-5439 https://security.archlinux.org/CVE-2017-5440 https://security.archlinux.org/CVE-2017-5441 https://security.archlinux.org/CVE-2017-5442 https://security.archlinux.org/CVE-2017-5443 https://security.archlinux.org/CVE-2017-5444 https://security.archlinux.org/CVE-2017-5445 https://security.archlinux.org/CVE-2017-5446 https://security.archlinux.org/CVE-2017-5447 https://security.archlinux.org/CVE-2017-5448 https://security.archlinux.org/CVE-2017-5449 https://security.archlinux.org/CVE-2017-5451 https://security.archlinux.org/CVE-2017-5453 https://security.archlinux.org/CVE-2017-5454 https://security.archlinux.org/CVE-2017-5455 https://security.archlinux.org/CVE-2017-5456 https://security.archlinux.org/CVE-2017-5458 https://security.archlinux.org/CVE-2017-5459 https://security.archlinux.org/CVE-2017-5460 https://security.archlinux.org/CVE-2017-5461 https://security.archlinux.org/CVE-2017-5464 https://security.archlinux.org/CVE-2017-5465 https://security.archlinux.org/CVE-2017-5466 https://security.archlinux.org/CVE-2017-5467 https://security.archlinux.org/CVE-2017-5468 https://security.archlinux.org/CVE-2017-5469

1 0

[arch-security] [ASA-201704-5] chromium: multiple issues
by Remi Gacogne 20 Apr '17

20 Apr '17

Arch Linux Security Advisory ASA-201704-5 ========================================= Severity: Critical Date : 2017-04-20 CVE-ID : CVE-2017-5057 CVE-2017-5058 CVE-2017-5059 CVE-2017-5060 CVE-2017-5061 CVE-2017-5062 CVE-2017-5063 CVE-2017-5064 CVE-2017-5065 CVE-2017-5066 CVE-2017-5067 CVE-2017-5069 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-250 Summary ======= The package chromium before version 58.0.3029.81-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, incorrect calculation and same-origin policy bypass. Resolution ========== Upgrade to 58.0.3029.81-1. # pacman -Syu "chromium>=58.0.3029.81-1" The problems have been fixed upstream in version 58.0.3029.81. Workaround ========== None. Description =========== - CVE-2017-5057 (arbitrary code execution) A type confusion issue has been found in the PDFium component of the Chromium browser. - CVE-2017-5058 (arbitrary code execution) A heap use after free issue has been found in the Print Preview component of the Chromium browser. - CVE-2017-5059 (arbitrary code execution) A type confusion issue has been found in the Blink component of the Chromium browser. - CVE-2017-5060 (content spoofing) A URL spoofing issue has been found in the Omnibox component of the Chromium browser. - CVE-2017-5061 (content spoofing) A URL spoofing issue has been found in the Omnibox component of the Chromium browser. - CVE-2017-5062 (arbitrary code execution) A use after free issue has been found in the Chrome Apps component of the Chromium browser. - CVE-2017-5063 (arbitrary code execution) A heap overflow issue has been found in the Skia component of the Chromium browser. - CVE-2017-5064 (arbitrary code execution) A use after free flaw has been found in the Blink component of the Chromium browser. - CVE-2017-5065 (content spoofing) An incorrect UI issue has been found in the Blink component of the Chromium browser. - CVE-2017-5066 (incorrect calculation) An incorrect signature handing issue has been found in the Networking component of the Chromium browser. - CVE-2017-5067 (content spoofing) A URL spoofing issue has been found in the Omnibox component of the Chromium browser. - CVE-2017-5069 (same-origin policy bypass) A cross-origin bypass issue has been found in the Blink component of the Chromium browser. Impact ====== A remote attacker can spoof URL, bypass security checks and execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-des… https://crbug.com/695826 https://crbug.com/694382 https://crbug.com/684684 https://crbug.com/683314 https://crbug.com/672847 https://crbug.com/702896 https://crbug.com/700836 https://crbug.com/693974 https://crbug.com/704560 https://crbug.com/690821 https://crbug.com/648117 https://crbug.com/691726 https://security.archlinux.org/CVE-2017-5057 https://security.archlinux.org/CVE-2017-5058 https://security.archlinux.org/CVE-2017-5059 https://security.archlinux.org/CVE-2017-5060 https://security.archlinux.org/CVE-2017-5061 https://security.archlinux.org/CVE-2017-5062 https://security.archlinux.org/CVE-2017-5063 https://security.archlinux.org/CVE-2017-5064 https://security.archlinux.org/CVE-2017-5065 https://security.archlinux.org/CVE-2017-5066 https://security.archlinux.org/CVE-2017-5067 https://security.archlinux.org/CVE-2017-5069

1 0

[arch-security] [ASA-201704-4] nss: arbitrary code execution
by Remi Gacogne 20 Apr '17

20 Apr '17

Arch Linux Security Advisory ASA-201704-4 ========================================= Severity: Critical Date : 2017-04-20 CVE-ID : CVE-2017-5461 Package : nss Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-247 Summary ======= The package nss before version 3.30.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.30.1-1. # pacman -Syu "nss>=3.30.1-1" The problem has been fixed upstream in version 3.30.1. Workaround ========== None. Description =========== An out-of-bounds write during Base64 decoding operation has been found in the Network Security Services (NSS) library due to insufficient memory being allocated to the buffer. An attacker could use this flaw to create a specially crafted certificate which, when parsed by NSS, could cause it to crash or execute arbitrary code, using the permissions of the user running an application compiled against the NSS library. The issue has been fixed in releases 3.29.5 and 3.30.1. Impact ====== A remote attacker can execute arbitrary code on the affected host, using a specially crafted certificate. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5461 https://bugzilla.mozilla.org/show_bug.cgi?id=1344380 https://hg.mozilla.org/projects/nss/rev/ac34db053672 https://security.archlinux.org/CVE-2017-5461

1 0

[arch-security] [ASA-201704-3] mediawiki: multiple issues
by Remi Gacogne 10 Apr '17

10 Apr '17

Arch Linux Security Advisory ASA-201704-3 ========================================= Severity: High Date : 2017-04-07 CVE-ID : CVE-2017-0361 CVE-2017-0362 CVE-2017-0363 CVE-2017-0364 CVE-2017-0365 CVE-2017-0366 CVE-2017-0367 CVE-2017-0368 CVE-2017-0369 CVE-2017-0370 CVE-2017-0372 Package : mediawiki Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-236 Summary ======= The package mediawiki before version 1.28.1-1 is vulnerable to multiple issues including arbitrary code execution, cross-site scripting, information disclosure, cross-site request forgery, insufficient validation, open redirect and access restriction bypass. Resolution ========== Upgrade to 1.28.1-1. # pacman -Syu "mediawiki>=1.28.1-1" The problems have been fixed upstream in version 1.28.1. Workaround ========== None. Description =========== - CVE-2017-0361 (information disclosure) MediaWiki before 1.28.1 may leak passwords in plaintext. API parameters may now be marked as "sensitive" to keep their values out of the logs. - CVE-2017-0362 (cross-site request forgery) MediaWiki before 1.18.1 did not require a CSRF token for the "Mark all pages visited" action on the watchlist. - CVE-2017-0363 (open redirect) The Special:UserLogin page in MediaWiki < 1.28.1 has an open redirect issue. - CVE-2017-0364 (open redirect) The Special:Search page in MediaWiki < 1.28.1 has an open redirect issue. - CVE-2017-0365 (cross-site scripting) SearchHighlighter::removeWiki() uses a regex to remove html from snippets. The regex - /<\/?[^>]+>/ assumes that html is well-formed. As a result when using SearchHighlighter::highlightText() as the highlighting method, this can result in an XSS when $wgAdvancedSearchHighlighting is true. - CVE-2017-0366 (cross-site scripting) MediaWiki < 1.28.1 did not properly filter the DTD declaration when a SVG file was uploaded, leading to a persistent XSS. - CVE-2017-0367 (arbitrary code execution) MediaWiki before 1.28.1 uses the default system temporary directory for the LocalisationCache directory, allowing a local attacker to execute arbitrary code as the web user by crafting a cache file whose content will be passe to unserialize(). - CVE-2017-0368 (cross-site scripting) MediaWiki < 1.28.1 did not properly mark system messages as raw HTML, hence not properly escaping it. - CVE-2017-0369 (access restriction bypass) In MediaWiki < 1.28.1, a normal sysop that doesn't have the necessary rights to override a page protection can still recreate it by restoring a former revision of that page. - CVE-2017-0370 (insufficient validation) The spam blacklist in MediaWiki before 1.28.1 could be bypassed by encoding URLs inside a file inclusion syntax's link parameter. - CVE-2017-0372 (cross-site scripting) The SyntaxHighlight extension in MediaWiki before 1.28.1 does not properly validate the 'start' parameter before passing it to Pygments. Impact ====== A remote attacker might be able to access sensitive information, trick users into visiting a malicious website, execute arbitrary JavaScript on the visitor's browser, trick users into performing unwanted actions and bypass access restrictions. A local attacker might be able to execute arbitrary code with the privileges of the webserver. References ========== https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.… https://phabricator.wikimedia.org/T125177 https://phabricator.wikimedia.org/T150044 https://phabricator.wikimedia.org/T109140 https://phabricator.wikimedia.org/T122209 https://phabricator.wikimedia.org/T144845 https://phabricator.wikimedia.org/T151735 https://phabricator.wikimedia.org/T161453 https://phabricator.wikimedia.org/T156184 https://phabricator.wikimedia.org/T108138 https://phabricator.wikimedia.org/T48143 https://phabricator.wikimedia.org/T158689 https://security.archlinux.org/CVE-2017-0361 https://security.archlinux.org/CVE-2017-0362 https://security.archlinux.org/CVE-2017-0363 https://security.archlinux.org/CVE-2017-0364 https://security.archlinux.org/CVE-2017-0365 https://security.archlinux.org/CVE-2017-0366 https://security.archlinux.org/CVE-2017-0367 https://security.archlinux.org/CVE-2017-0368 https://security.archlinux.org/CVE-2017-0369 https://security.archlinux.org/CVE-2017-0370 https://security.archlinux.org/CVE-2017-0372

1 0

[arch-security] Subject: [ASA-201704-2] python-django: multiple issues
by Jelle van der Waa 09 Apr '17

09 Apr '17

Arch Linux Security Advisory ASA-201704-2 ========================================= Severity: Medium Date : 2017-04-06 CVE-ID : CVE-2017-7233 CVE-2017-7234 Package : python-django Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-233 Summary ======= The package python-django before version 1.11-1 is vulnerable to multiple issues including cross-site scripting and open redirect. Resolution ========== Upgrade to 1.11-1. # pacman -Syu "python-django>=1.11-1" The problems have been fixed upstream in version 1.11. Workaround ========== None. Description =========== - CVE-2017-7233 (cross-site scripting) Django relies on user input in some cases (e.g. django.contrib.auth.views.login() and i18n) to redirect the user to an “on success” URL. The security check for these redirects (namely django.utils.http.is_safe_url()) considered some numeric URLs (e.g. http:999999999) “safe” when they shouldn’t be. Also, if a developer relies on is_safe_url() to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack. - CVE-2017-7234 (open redirect) A maliciously crafted URL to a Django site using the serve() view could redirect to any other domain. The view no longer does any redirects as they don’t provide any known, useful functionality. Note, however, that this view has always carried a warning that it is not hardened for production use and should be used only as a development aid. Impact ====== A remote attacker is able to use a specially crafted numeric-URL to execute arbitrary javascript on the client's machine and craft a malious URL to a Django site which could redirect to any other domain. References ========== https://docs.djangoproject.com/en/dev/releases/1.11 https://security.archlinux.org/CVE-2017-7233 https://security.archlinux.org/CVE-2017-7234

1 0

[arch-security] [ASA-201704-1] python2-django: multiple issues
by Jelle van der Waa 09 Apr '17

09 Apr '17

Arch Linux Security Advisory ASA-201704-1 ========================================= Severity: Medium Date : 2017-04-06 CVE-ID : CVE-2017-7233 CVE-2017-7234 Package : python2-django Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-233 Summary ======= The package python2-django before version 1.11-1 is vulnerable to multiple issues including cross-site scripting and open redirect. Resolution ========== Upgrade to 1.11-1. # pacman -Syu "python2-django>=1.11-1" The problems have been fixed upstream in version 1.11. Workaround ========== None. Description =========== - CVE-2017-7233 (cross-site scripting) Django relies on user input in some cases (e.g. django.contrib.auth.views.login() and i18n) to redirect the user to an “on success” URL. The security check for these redirects (namely django.utils.http.is_safe_url()) considered some numeric URLs (e.g. http:999999999) “safe” when they shouldn’t be. Also, if a developer relies on is_safe_url() to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack. - CVE-2017-7234 (open redirect) A maliciously crafted URL to a Django site using the serve() view could redirect to any other domain. The view no longer does any redirects as they don’t provide any known, useful functionality. Note, however, that this view has always carried a warning that it is not hardened for production use and should be used only as a development aid. Impact ====== A remote attacker is able to use a specially crafted numeric-URL to execute arbitrary javascript on the client's machine and craft a malious URL to a Django site which could redirect to any other domain. References ========== https://docs.djangoproject.com/en/dev/releases/1.11 https://security.archlinux.org/CVE-2017-7233 https://security.archlinux.org/CVE-2017-7234

1 0

[arch-security] [ASA-201703-19] chromium: arbitrary code execution
by Remi Gacogne 31 Mar '17

31 Mar '17

Arch Linux Security Advisory ASA-201703-19 ========================================== Severity: Critical Date : 2017-03-31 CVE-ID : CVE-2017-5052 CVE-2017-5053 CVE-2017-5054 CVE-2017-5055 CVE-2017-5056 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-231 Summary ======= The package chromium before version 57.0.2987.133-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 57.0.2987.133-1. # pacman -Syu "chromium>=57.0.2987.133-1" The problems have been fixed upstream in version 57.0.2987.133. Workaround ========== None. Description =========== - CVE-2017-5052 (arbitrary code execution) An invalid cast vulnerability has been found in the Blink component of the Chromium browser. - CVE-2017-5053 (arbitrary code execution) An out of bounds memory access vulnerability has been found in the V8 component of the Chromium browser. - CVE-2017-5054 (arbitrary code execution) A heap buffer overflow vulnerability has been found in the V8 component of the Chromium browser. - CVE-2017-5055 (arbitrary code execution) A use-after-free vulnerability has been found in the printing component of the Chromium browser. - CVE-2017-5056 (arbitrary code execution) A use-after-free vulnerability has been found in the Blink component of the Chromium browser. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=662767 https://bugs.chromium.org/p/chromium/issues/detail?id=702058 https://bugs.chromium.org/p/chromium/issues/detail?id=699166 https://bugs.chromium.org/p/chromium/issues/detail?id=698622 https://bugs.chromium.org/p/chromium/issues/detail?id=705445 https://security.archlinux.org/CVE-2017-5052 https://security.archlinux.org/CVE-2017-5053 https://security.archlinux.org/CVE-2017-5054 https://security.archlinux.org/CVE-2017-5055 https://security.archlinux.org/CVE-2017-5056

1 0

[arch-security] [ASA-201703-18] libpurple: arbitrary code execution
by Levente Polyak 23 Mar '17

23 Mar '17

Arch Linux Security Advisory ASA-201703-18 ========================================== Severity: High Date : 2017-03-21 CVE-ID : CVE-2017-2640 Package : libpurple Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-226 Summary ======= The package libpurple before version 2.12.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.12.0-1. # pacman -Syu "libpurple>=2.12.0-1" The problem has been fixed upstream in version 2.12.0. Workaround ========== None. Description =========== An out-of-bounds write has been found in libpurple < 2.12.0 in the purple_markup_unescape_entity function. This issue can be triggered by a malicious server sending invalid XML entities separated by whitespace, eg "ஸ" to the client. Impact ====== A remote attacker is able to execute arbitrary code on the affected host if it connects to a malicious server. References ========== http://seclists.org/fulldisclosure/2017/Mar/57 https://www.pidgin.im/news/security/?id=109 https://bitbucket.org/pidgin/main/commits/b2fc9e774cb9 https://security.archlinux.org/CVE-2017-2640

1 0

[arch-security] [ASA-201703-17] irssi: arbitrary code execution
by Santiago Torres-Arias 21 Mar '17

21 Mar '17

Arch Linux Security Advisory ASA-201703-17 ========================================== Severity: High Date : 2017-03-21 CVE-ID : CVE-2017-7191 Package : irssi Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-224 Summary ======= The package irssi before version 1.0.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.0.2-1. # pacman -Syu "irssi>=1.0.2-1" The problem has been fixed upstream in version 1.0.2. Workaround ========== None. Description =========== A use after free vulnerability has been discovered in irssi < 1.0.2 while producing a list of netjoins that can result in arbitrary code execution. Impact ====== A malicious attacker is able to crash the irssi process or execute arbitrary code on the host by forcing a server disconnection during a netsplit. References ========== https://irssi.org/security/irssi_sa_2017_03.txt https://security.archlinux.org/CVE-2017-7191

1 0